764a5dd65e9bf2f943a25c7f8331e32cffd0c79dd03ce5f63b447dff6fc480af

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.7MB
Sample260517-nd22csfv7v
SHA256 764a5dd65e9bf2f943a25c7f8331e32cffd0c79dd03ce5f63b447dff6fc480af
MD5 fb9ea3baa937e8378c4da2eabf91aa46
SHA1 df6c141d2c56e48a55828554060969499015761c
SHA512 593349697b6ab04265344afc20d7b32cbf2e5490704462344c62d24baf50c8454d83cb8ca2d868aae8d2ccc85e02cb641593017917515b20f01ce6af3e5bf6cc
SSDEEP 24576:n3toMtBkKn1OB95/lYAOffizD34ZKXrWLkkkkkkknX3eAz:3tV51OB95/KfizDIYXnXz
TLSH
T19D858C03F68681E5D05DC2788E764725EA72BC255F30A6DF0290BA252EB7AD01F3DBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2816	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX5D4F.tmp	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5EF7.tmp	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5D5F.tmp	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5F17.tmp	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2816	2968	2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ie_to_edge_stub.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
Size 626KB
SHA256 b25dbd72f2dbae8bc586e5fa41dda4c40611193f4b11894e4fc02dbbbdfe1d45
MD5 136499d8eeb914c65eab41825f4047ae
SHA1 5a55bba82b1373566a504d57155da592a8719346
SHA512 f38c9c2e37b8912a77b4b08d131c24ff7539c580fbeb141f5240285db8e743df2d260b03a5d498ffda709a62ef49d2b164f1b381f6e744ea9b4c8a529ba97ca1
SSDEEP 12288:dUNWURoS86nHrUA9HVlK8SQBJ9t4f15rL:g3L86n9kAJ9tA3L
TLSH
T138D4AE41B7D847E9E02AC534CA428686DAB57C961B61F6DF03A0427A3F336E54F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-17_fb9ea3baa937e8378c4da2eabf91aa46_cobalt-strike_elex_icedid_njrat_vidar.exe
Size 1.6MB
SHA256 ce5642aad0ec024d7bac19c1993ee90a5667c1a8dc6dc582cdd36e88a087037e
MD5 e9031fdacc5f7002af051f66c92defc2
SHA1 7da4975ea4920bca44736b498cb2e03c12a578dd
SHA512 031b72e8c756e2fa60a1b1e6cd2b8a702d910f7d2485dc8603e6862720481ebcead78f624e3a3114b2622922f957fbdcede71f4844ab31ac6056571494c6efc6
SSDEEP 24576:koMtBkKn1OB95/lYAOffizD34ZKXrWLkkkkkkknX3eAz:kV51OB95/KfizDIYXnXz
TLSH
T1C1758C03F68641E5D05EC2788E764725EA72BC255F30A6DF0290BA252EB7AD01F3DBD1
MD5 SHA1 SHA512 SSDEEP TLSH